Friday, November 8, 2024
HomeMalwareTrickbot Malware Campaign Targets users with COVID-19 Themed Malspam

Trickbot Malware Campaign Targets users with COVID-19 Themed Malspam

Published on

Malware protection

The Cyberthreat uses COVID-19 themed malspam to distribute the Trickbot malware, says IBM Security Researchers. This time attacker utilizes FMLA (Family and Medical Leave Act) to lure the user over COVID-19 medical leaves with the attachment named “Family and Medical Leave of Act 22.04.doc” to distribute the malware. Spam mail disguised to come from the U.S. Department of Labor (DoL).

Trickbot Campaigns

TrickBot is a sophisticated banking Trojan operated by an organized cybercrime gang. Users infected with the TrickBot Trojan becomes part of a botnet that can allow attackers to gain complete control of the device.

Typical consequences of TrickBot infections are bank account takeover, high-value wire fraud, and possibly ransomware attacks targeting organizational networks. Mainly financially motivated cyber-attacks.

- Advertisement - SIEM as a Service

DocuSign themes used by Trickbot

Sample email US-DoL.eml, contains three attachments: uslogo.png, faq.png, and Family and Medical Leave of Act 22.04.doc.

As first two attachments were just image files and the third one “Family and Medical Leave of Act 22.04.doc” asks users to enable macros ((ThisDocument.cls), to drops the bat file into the user machine location ”C:\Test\terop.bat”.

Trickbot Malware Campaign

Using the cURL utility, the terop.bat file attempts to download an executable from what appears to be a hijacked or compromised domain: hxxps://www.omegasystemsuae[.]com/9hfudnsfl.exe .The file is set to be written to %APPDATA%\Bio_Tecs.exe.

Terop.bat contains TIMEOUT /T 30 and ping 8.8.8.8 commands to evade detection and delay execution.

Overall, the following files are used in the infection chain:

File NameFile CategoryFile HashParent
US-DoL.emlEmailf481ba37fdcfaee9fa991e203963bad8N/A
Family and Medical Leave of Act 22.04.docCarrier Filed341215eb15167870aeff64d5380a69bUS-DoL.eml
terop.batDownloader9f52f07856cdf2b076c27ae60cb0d100Family and Medical Leave of Act 22.04.doc
faq.pngBenigneb77c6a9fc86bd73d77b92c24ca889dbUS-DoL.eml
us-logo.pngBenign1af19e6717acf7f38b8f1a651c738954US-DoL.eml
Infection chain – Trickbot

Infection chain – Trickbot This has been observed that the “Macro on Close” function used in the Docusign theme became a tactic for Trickbot distributors.

Other Trickbot Campaigns

New TrickBot Module BruteForce RDP Connections Attacks Telecommunication Industry

Hackers Abusing Window 10 Remote Desktop ActiveX control to Install New Version of Trickbot Malware

TrickBot Credential Stealer Malware Abuses Google Suite to Hide Malicious Activity

Latest articles

CISA Warns of Critical Palo Alto Networks Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warns organizations of a critical vulnerability...

Cisco Desk Phone Series Vulnerability Lets Remote Attacker Access Sensitive Information

A significant vulnerability (CVE-2024-20445) has been discovered in Cisco Desk Phone 9800 Series, IP...

Cisco Flaw Let Attackers Run Command as Root User

A critical vulnerability has been discovered in Cisco Unified Industrial Wireless Software, which affects...

Researchers Detailed Credential Abuse Cycle

The United States Department of Justice has unsealed an indictment against Anonymous Sudan, a...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

HookBot Malware Use Overlay Attacks Impersonate As Popular Brands To Steal Data

The HookBot malware family employs overlay attacks to trick users into revealing sensitive information...

ToxicPanda Banking Malware Attacking Banking Users To Steal Logins

Recent research has uncovered a new strain of malware developed for Android devices, initially...

APT36 Hackers Attacking Windows Deevices With ElizaRAT

APT36, a sophisticated threat actor, has been actively targeting Indian entities with advanced malware...